oss-security - CVE-2022-0742: Remote Denial of Service on Linux Kernel >=5.13 icmp6

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAO06FutBccV46=p1+dGgpP1_UdyXYLYTjiMfKBVq2JoVKd4Yrw@mail.gmail.com>
Date: Tue, 15 Mar 2022 18:56:32 +0100
From: "sirdarckcat ." <sirdarckcat@...omium.org>
To: 3pvd@...gle.com, Eric Dumazet <edumazet@...gle.com>, oss-security@...ts.openwall.com
Subject: CVE-2022-0742: Remote Denial of Service on Linux Kernel >=5.13 icmp6

Flooding icmp6 messages of type 130 or 131 is enough to exploit a
memory leak in the kernel and cause the host to go out-of-memory. The
volume of traffic doesn't need to be particularly high. Note that
since the vulnerability was introduced recently (5.13) only 5.15's
stable was affected.

This vulnerability was found/fixed by Eric Dumazet.

CVE will land on MITRE's website sometime this week.

This was fixed on https://kernel.dance/2d3916f3189172d5c69d33065c3c21119fe539fc
 "the commit landed on upstream on": [
  {
   "tags": "tags/v5.17-rc7~18^2"
  }
 ],
 "the commit was backported to": [
  {
   "tags": "tags/v5.16.13~140",
   "commit": "5ed9983ce67341b405cf6fda826e29aed26a7371"
  },
  {
   "tags": "tags/v5.15.27~216",
   "commit": "771aca9bc70709771f66c3e7c00ce87339aa1790"
  }
 ],
 "the commit fixes a bug introduced by": [
  {
   "fixes": "f185de28d9ae (\"mld: add new workqueues for process mld events\")"
  }
 ],
 "the buggy commit landed on upstream on": [
  {
   "tags": "tags/v5.13-rc1~94^2~371^2~1",
   "commit": "f185de28d9ae6c978135993769352e523ee8df06"
  }
 ],

Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2d3916f3189172d5c69d33065c3c21119fe539fc

ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()
While investigating on why a synchronize_net() has been added recently
in ipv6_mc_down(), I found that igmp6_event_query() and igmp6_event_report()
might drop skbs in some cases.

Discussion about removing synchronize_net() from ipv6_mc_down()
will happen in a different thread.

Fixes: f185de28d9ae ("mld: add new workqueues for process mld events")
Signed-off-by: Eric Dumazet <edumazet@...gle.com>
Cc: Taehee Yoo <ap420073@...il.com>
Cc: Cong Wang <xiyou.wangcong@...il.com>
Cc: David Ahern <dsahern@...nel.org>
Link: https://lore.kernel.org/r/20220303173728.937869-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@...nel.org>

Timeline:

Following https://about.google/appsecurity/ policy:

Feb 23, 2022  - Discovery / Shared with network upstream maintainers,
reproduced, patch confirmed to work, CVE reserved
Feb 25, 2022 - security@...nel.org decides fix/disclosure timeline
Mar 3, 2022 - Patch lands on mainline (Linus tree)
2d3916f3189172d5c69d33065c3c21119fe539fc
Mar 8, 2022 - Patch lands on stable (5.15/5.16)
Mar 15, 2022 - This email is sent (public disclosure of vuln details)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.